@sd-jwt/core 0.19.1-next.1 → 0.19.1-next.11

package/src/test/kbjwt.spec.ts

@@ -1,14 +1,15 @@
 import Crypto, { type KeyLike } from 'node:crypto';
+import { exportJWK, importJWK, type JWK } from 'jose';
+import { describe, expect, test } from 'vitest';
+import { KBJwt } from '../kbjwt';
 import {
   type JwtPayload,
   KB_JWT_TYP,
   type KbVerifier,
+  type kbPayload,
   type Signer,
-} from '@sd-jwt/types';
-import type { SDJWTException } from '@sd-jwt/utils';
-import { exportJWK, importJWK, type JWK } from 'jose';
-import { describe, expect, test } from 'vitest';
-import { KBJwt } from '../kbjwt';
+} from '../types';
+import type { SDJWTException } from '../utils';
 
 describe('KB JWT', () => {
   test('create', async () => {
@@ -287,6 +288,216 @@ describe('KB JWT', () => {
     }
   });
 
+  test('verify failed with expired exp claim', async () => {
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+    const testSigner: Signer = async (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const payload = {
+      cnf: {
+        jwk: await exportJWK(publicKey),
+      },
+    };
+    const testVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      const publicKey = payload.cnf?.jwk;
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(publicKey as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbJwt = new KBJwt({
+      header: {
+        typ: KB_JWT_TYP,
+        alg: 'EdDSA',
+      },
+      payload: {
+        iat: 1,
+        aud: 'aud',
+        nonce: 'nonce',
+        sd_hash: 'hash',
+        // expired one hour before the current date used below
+        exp: 1000,
+      } as kbPayload,
+    });
+    const encodedKbJwt = await kbJwt.sign(testSigner);
+    const decoded = KBJwt.fromKBEncode(encodedKbJwt);
+
+    await expect(
+      decoded.verifyKB({
+        verifier: testVerifier,
+        payload,
+        nonce: 'nonce',
+        options: { currentDate: 5000 },
+      }),
+    ).rejects.toThrow('Verify Error: JWT is expired');
+  });
+
+  test('verify failed with iat in the future', async () => {
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+    const testSigner: Signer = async (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const payload = {
+      cnf: {
+        jwk: await exportJWK(publicKey),
+      },
+    };
+    const testVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      const publicKey = payload.cnf?.jwk;
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(publicKey as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbJwt = new KBJwt({
+      header: {
+        typ: KB_JWT_TYP,
+        alg: 'EdDSA',
+      },
+      payload: {
+        iat: 5000,
+        aud: 'aud',
+        nonce: 'nonce',
+        sd_hash: 'hash',
+      },
+    });
+    const encodedKbJwt = await kbJwt.sign(testSigner);
+    const decoded = KBJwt.fromKBEncode(encodedKbJwt);
+
+    await expect(
+      decoded.verifyKB({
+        verifier: testVerifier,
+        payload,
+        nonce: 'nonce',
+        // iat (5000) is after the current date (1000)
+        options: { currentDate: 1000 },
+      }),
+    ).rejects.toThrow('Verify Error: JWT is not yet valid');
+  });
+
+  test('verify failed with nbf in the future', async () => {
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+    const testSigner: Signer = async (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const payload = {
+      cnf: {
+        jwk: await exportJWK(publicKey),
+      },
+    };
+    const testVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      const publicKey = payload.cnf?.jwk;
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(publicKey as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbJwt = new KBJwt({
+      header: {
+        typ: KB_JWT_TYP,
+        alg: 'EdDSA',
+      },
+      payload: {
+        iat: 1,
+        aud: 'aud',
+        nonce: 'nonce',
+        sd_hash: 'hash',
+        nbf: 5000,
+      } as kbPayload,
+    });
+    const encodedKbJwt = await kbJwt.sign(testSigner);
+    const decoded = KBJwt.fromKBEncode(encodedKbJwt);
+
+    await expect(
+      decoded.verifyKB({
+        verifier: testVerifier,
+        payload,
+        nonce: 'nonce',
+        options: { currentDate: 1000 },
+      }),
+    ).rejects.toThrow('Verify Error: JWT is not yet valid');
+  });
+
+  test('verify succeeds for expired exp within the allowed skew', async () => {
+    const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
+    const testSigner: Signer = async (data: string) => {
+      const sig = Crypto.sign(null, Buffer.from(data), privateKey);
+      return Buffer.from(sig).toString('base64url');
+    };
+
+    const payload = {
+      cnf: {
+        jwk: await exportJWK(publicKey),
+      },
+    };
+    const testVerifier: KbVerifier = async (
+      data: string,
+      sig: string,
+      payload: JwtPayload,
+    ) => {
+      const publicKey = payload.cnf?.jwk;
+      return Crypto.verify(
+        null,
+        Buffer.from(data),
+        (await importJWK(publicKey as JWK, 'EdDSA')) as KeyLike,
+        Buffer.from(sig, 'base64url'),
+      );
+    };
+
+    const kbJwt = new KBJwt({
+      header: {
+        typ: KB_JWT_TYP,
+        alg: 'EdDSA',
+      },
+      payload: {
+        iat: 1,
+        aud: 'aud',
+        nonce: 'nonce',
+        sd_hash: 'hash',
+        exp: 1000,
+      } as kbPayload,
+    });
+    const encodedKbJwt = await kbJwt.sign(testSigner);
+    const decoded = KBJwt.fromKBEncode(encodedKbJwt);
+
+    // exp (1000) is before the current date (1100) but within the 200s skew
+    const verified = await decoded.verifyKB({
+      verifier: testVerifier,
+      payload,
+      nonce: 'nonce',
+      options: { currentDate: 1100, skewSeconds: 200 },
+    });
+
+    expect(verified.payload.exp).toBe(1000);
+  });
+
   test('compatibility test for version 06', async () => {
     const { privateKey, publicKey } = Crypto.generateKeyPairSync('ed25519');
     const testSigner: Signer = async (data: string) => {

package/src/test/present/present.spec.ts

@@ -0,0 +1,305 @@
+import { hasher as digest } from '@owf/crypto';
+import { describe, expect, test } from 'vitest';
+import { decodeSdJwt, decodeSdJwtSync } from '../../decode';
+import {
+  present,
+  presentableKeys,
+  presentableKeysSync,
+  presentSync,
+  type SerializedDisclosure,
+  selectDisclosures,
+  transformPresentationFrame,
+} from '../../present';
+import type { PresentationFrame } from '../../types';
+
+describe('Present tests', () => {
+  test('presentableKeys', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = await decodeSdJwt(sdjwt, digest);
+    const keys = await presentableKeys(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(keys).toStrictEqual(['arr', 'arr.0', 'arr.2.a', 'foo', 'test.zzz']);
+  });
+
+  test('presentableKeys sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const decodedSdJwt = decodeSdJwtSync(sdjwt, digest);
+    const keys = presentableKeysSync(
+      decodedSdJwt.jwt.payload,
+      decodedSdJwt.disclosures,
+      digest,
+    );
+    expect(keys).toStrictEqual(['arr', 'arr.0', 'arr.2.a', 'foo', 'test.zzz']);
+  });
+
+  test('present', async () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const presentedSdJwt = await present(
+      sdjwt,
+      {
+        foo: true,
+        arr: {
+          0: true,
+        },
+        test: {
+          zzz: true,
+        },
+      },
+      digest,
+    );
+    expect(presentedSdJwt).toStrictEqual(
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~',
+    );
+  });
+
+  test('present sync', () => {
+    const sdjwt =
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIwNGU0MjAzOWU4ZWFiOWRjIiwiYSIsIjEiXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~';
+    const presentedSdJwt = presentSync(
+      sdjwt,
+      {
+        foo: true,
+        arr: {
+          0: true,
+        },
+        test: {
+          zzz: true,
+        },
+      },
+      digest,
+    );
+    expect(presentedSdJwt).toStrictEqual(
+      'eyJ0eXAiOiJzZC1qd3QiLCJhbGciOiJFZERTQSJ9.eyJ0ZXN0Ijp7Il9zZCI6WyJqVEszMHNleDZhYV9kUk1KSWZDR056Q0FwbVB5MzRRNjNBa3QzS3hhSktzIl19LCJfc2QiOlsiME9nMi1ReG95eW1UOGNnVzZZUjVSSFpQLUJuR2tHUi1NM2otLV92RWlzSSIsIkcwZ3lHNnExVFMyUlQxMkZ3X2RRRDVVcjlZc1AwZlVWOXVtQWdGMC1jQ1EiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.ggEyE4SeDO2Hu3tol3VLmi7NQj56yKzKQDaafocgkLrUBdivghohtzrfcbrMN7CRufJ_Cnh0EL54kymXLGTdDQ~WyIxYzdmOTE4ZTE0MjA2NzZiIiwiZm9vIiwiYmFyIl0~WyJmZjYxYzQ5ZGU2NjFiYzMxIiwiYXJyIixbeyIuLi4iOiJTSG96VW5KNUpkd0ZtTjVCbXB5dXZCWGZfZWRjckVvcExPYThTVlBFUmg0In0sIjIiLHsiX3NkIjpbIkpuODNhZkp0OGx4NG1FMzZpRkZyS2U2R2VnN0dlVUQ4Z3UwdVo3NnRZcW8iXX1dXQ~WyIwOGE1Yjc5MjMyYjAzYzBhIiwiMSJd~WyJiNWE2YjUzZGQwYTFmMGIwIiwienp6IiwieHh4Il0~',
+    );
+  });
+
+  test('transform an object for a presentation to a list', () => {
+    const claims = {
+      firstname: 'John',
+      lastname: 'Doe',
+      ssn: '123-45-6789',
+      id: '1234',
+      data: {
+        firstname: 'John',
+        lastname: 'Doe',
+        ssn: '123-45-6789',
+        list: [{ r: 'd' }, 'b', 'c'],
+        list2: ['1', '2', '3'],
+        list3: ['1', null, 2],
+      },
+      data2: {
+        hi: 'bye',
+      },
+    };
+
+    const presentFrame: PresentationFrame<typeof claims> = {
+      firstname: true,
+      data: {
+        firstname: true,
+        list: {
+          1: true,
+          0: {
+            r: true,
+          },
+        },
+        list2: {
+          1: true,
+        },
+        list3: true,
+      },
+      data2: true,
+    };
+
+    const list = transformPresentationFrame(presentFrame);
+    expect(list).toStrictEqual([
+      'firstname',
+      'data',
+      'data.firstname',
+      'data.list',
+      'data.list.0',
+      'data.list.0.r',
+      'data.list.1',
+      'data.list2',
+      'data.list2.1',
+      'data.list3',
+      'data2',
+    ]);
+  });
+
+  test('transform an object for a presentation to a list, but with faulty inputs', () => {
+    const claims = {
+      name: 'John',
+      address: {
+        city: 'New York',
+        street: '5th Avenue',
+      },
+    };
+
+    const obj: PresentationFrame<typeof claims> = {
+      name: false,
+      address: {
+        city: true,
+        street: true,
+      },
+    };
+    const list = transformPresentationFrame(obj);
+    expect(list).toStrictEqual(['address', 'address.city', 'address.street']);
+  });
+
+  test('select disclosures', () => {
+    const payload = {
+      lastname: 'Doe',
+      _sd: [
+        'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+      ],
+      _sd_alg: 'sha-256',
+    };
+
+    const presentationFrame = {
+      firstname: true,
+      //ssn: true,
+      id: true,
+    };
+
+    const disclosures: SerializedDisclosure[] = [
+      {
+        digest: 'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        encoded: 'WyJiMDQ3NjBiOTgxMDgyM2ZhIiwiZmlyc3RuYW1lIiwiSm9obiJd',
+        salt: 'b04760b9810823fa',
+        key: 'firstname',
+        value: 'John',
+      },
+      {
+        digest: 'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        encoded: 'WyJjNTQwZWE4YjJhOTNmZDE1Iiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ',
+        salt: 'c540ea8b2a93fd15',
+        key: 'ssn',
+        value: '123-45-6789',
+      },
+      {
+        digest: 'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+        encoded: 'WyI5N2YwNTVkZTk0NGFmNzI5IiwiaWQiLCIxMjM0Il0',
+        salt: '97f055de944af729',
+        key: 'id',
+        value: '1234',
+      },
+    ];
+
+    const selected = selectDisclosures(payload, disclosures, presentationFrame);
+    expect(selected).toStrictEqual([
+      {
+        digest: 'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        encoded: 'WyJiMDQ3NjBiOTgxMDgyM2ZhIiwiZmlyc3RuYW1lIiwiSm9obiJd',
+        salt: 'b04760b9810823fa',
+        key: 'firstname',
+        value: 'John',
+      },
+      {
+        digest: 'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+        encoded: 'WyI5N2YwNTVkZTk0NGFmNzI5IiwiaWQiLCIxMjM0Il0',
+        salt: '97f055de944af729',
+        key: 'id',
+        value: '1234',
+      },
+    ]);
+  });
+
+  test('select disclosures no input', () => {
+    const selected = selectDisclosures({}, [], {});
+    expect(selected).toStrictEqual([]);
+  });
+
+  test('select disclosures noting return', () => {
+    const payload = {
+      lastname: 'Doe',
+      _sd: [
+        'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+      ],
+      _sd_alg: 'sha-256',
+    };
+
+    const presentationFrame = {};
+
+    const disclosures: SerializedDisclosure[] = [
+      {
+        digest: 'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        encoded: 'WyJiMDQ3NjBiOTgxMDgyM2ZhIiwiZmlyc3RuYW1lIiwiSm9obiJd',
+        salt: 'b04760b9810823fa',
+        key: 'firstname',
+        value: 'John',
+      },
+      {
+        digest: 'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        encoded: 'WyJjNTQwZWE4YjJhOTNmZDE1Iiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ',
+        salt: 'c540ea8b2a93fd15',
+        key: 'ssn',
+        value: '123-45-6789',
+      },
+      {
+        digest: 'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+        encoded: 'WyI5N2YwNTVkZTk0NGFmNzI5IiwiaWQiLCIxMjM0Il0',
+        salt: '97f055de944af729',
+        key: 'id',
+        value: '1234',
+      },
+    ];
+    const selected = selectDisclosures(payload, disclosures, presentationFrame);
+    expect(selected).toStrictEqual([]);
+  });
+
+  test('expect missing digest', () => {
+    const payload = {
+      lastname: 'Doe',
+      _sd: [
+        'COnqXH7wGBFGR1ao12sDwTfu84Zs7cq92CZIg8ulIuU',
+        'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+      ],
+      _sd_alg: 'sha-256',
+    };
+
+    const presentationFrame = {
+      firstname: true,
+      //ssn: true,
+      id: true,
+    };
+
+    const disclosures: SerializedDisclosure[] = [
+      //@ts-expect-error
+      {
+        encoded: 'WyJiMDQ3NjBiOTgxMDgyM2ZhIiwiZmlyc3RuYW1lIiwiSm9obiJd',
+        salt: 'b04760b9810823fa',
+        key: 'firstname',
+        value: 'John',
+      },
+      {
+        digest: 'RrOc4ZfBVyD6iNlMbtmdokZOti322mOXfvIOBKvpuc4',
+        encoded: 'WyJjNTQwZWE4YjJhOTNmZDE1Iiwic3NuIiwiMTIzLTQ1LTY3ODkiXQ',
+        salt: 'c540ea8b2a93fd15',
+        key: 'ssn',
+        value: '123-45-6789',
+      },
+      {
+        digest: 'aXqInKwHoE1l8OM1VNUQDqTPeNUG1cMJVwVbxZJpP14',
+        encoded: 'WyI5N2YwNTVkZTk0NGFmNzI5IiwiaWQiLCIxMjM0Il0',
+        salt: '97f055de944af729',
+        key: 'id',
+        value: '1234',
+      },
+    ];
+
+    expect(() =>
+      selectDisclosures(payload, disclosures, presentationFrame),
+    ).toThrowError('Unreferenced disclosure(s) detected in SD-JWT');
+  });
+});

package/src/test/sdjwt.spec.ts

@@ -1,11 +1,11 @@
 import Crypto from 'node:crypto';
-import { generateSalt, digest as hasher } from '@sd-jwt/crypto-nodejs';
-import { createHashMapping, unpack } from '@sd-jwt/decode';
-import type { DisclosureFrame, Signer } from '@sd-jwt/types';
-import { Disclosure } from '@sd-jwt/utils';
+import { generateSalt, hasher } from '@owf/crypto';
 import { describe, expect, test } from 'vitest';
+import { createHashMapping, unpack } from '../decode';
 import { Jwt } from '../jwt';
 import { listKeys, pack, SDJwt } from '../sdjwt';
+import type { DisclosureFrame, Signer } from '../types';
+import { Disclosure } from '../utils';
 
 const hash = { alg: 'SHA256', hasher };
 

package/src/test/types/type.spec.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from 'vitest';
+import {
+  type DisclosureFrame,
+  KB_JWT_TYP,
+  type PresentationFrame,
+  SD_DECOY,
+  SD_DIGEST,
+  SD_LIST_KEY,
+  SD_SEPARATOR,
+} from '../../types';
+
+const claims = {
+  firstname: 'John',
+  lastname: 'Doe',
+  ssn: '123-45-6789',
+  id: '1234',
+  data: {
+    firstname: 'John',
+    lastname: 'Doe',
+    ssn: '123-45-6789',
+    list: [{ r: 'd' }, 'b', 'c'],
+    list2: ['1', '2', '3'],
+    list3: ['1', null, 2],
+  },
+  data2: {
+    hi: 'bye',
+  },
+};
+
+describe('Variable tests', () => {
+  test('SD_SEPARATOR', () => {
+    expect(SD_SEPARATOR).toBe('~');
+  });
+
+  test('SD_LIST_KEY', () => {
+    expect(SD_LIST_KEY).toBe('...');
+  });
+
+  test('SD_DIGEST', () => {
+    expect(SD_DIGEST).toBe('_sd');
+  });
+
+  test('SD_DECOY', () => {
+    expect(SD_DECOY).toBe('_sd_decoy');
+  });
+
+  test('KB_JWT_TYP', () => {
+    expect(KB_JWT_TYP).toBe('kb+jwt');
+  });
+
+  test('DisclosureFrameType test', () => {
+    const disclosureFrame: DisclosureFrame<typeof claims> = {
+      _sd: ['data', 'firstname', 'data2'],
+      data: {
+        _sd: ['list', 'ssn'],
+        _sd_decoy: 2,
+        list: {
+          _sd: [0, 2],
+          0: {
+            _sd: ['r'],
+          },
+        },
+      },
+    };
+    expect(disclosureFrame).toBeDefined();
+  });
+
+  test('PresentationFrameType test', () => {
+    const presentationFrame: PresentationFrame<typeof claims> = {
+      firstname: true,
+      data: {
+        firstname: true,
+        list: {
+          1: true,
+          0: {
+            r: true,
+          },
+        },
+        list2: {
+          1: true,
+        },
+        list3: true,
+      },
+      data2: true,
+    };
+    expect(presentationFrame).toBeDefined();
+  });
+});

package/src/test/utils/base64url.spec.ts

@@ -0,0 +1,33 @@
+import { describe, expect, test } from 'vitest';
+import {
+  base64UrlToUint8Array,
+  base64urlDecode,
+  base64urlEncode,
+  uint8ArrayToBase64Url,
+} from '../../utils/base64url';
+
+describe('Base64url', () => {
+  const raw = 'abcdefghijklmnopqrstuvwxyz';
+  const encoded = 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXo';
+  test('Encode', () => {
+    expect(base64urlEncode(raw)).toStrictEqual(encoded);
+  });
+  test('Decode', () => {
+    expect(base64urlDecode(encoded)).toStrictEqual(raw);
+  });
+  test('Encode and decode', () => {
+    const str = 'hello world';
+    expect(base64urlDecode(base64urlEncode(str))).toStrictEqual(str);
+  });
+  test('Uint8Array', () => {
+    const str = 'hello world';
+    const uint8 = new TextEncoder().encode(str);
+    expect(uint8ArrayToBase64Url(uint8)).toStrictEqual(base64urlEncode(str));
+  });
+
+  test('Base64Url to Uint8Array', () => {
+    const str = 'hello world';
+    const uint8 = new TextEncoder().encode(str);
+    expect(base64UrlToUint8Array(base64urlEncode(str))).toStrictEqual(uint8);
+  });
+});